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AMENDMENTS TO THE CLAIMS: 

This listing of claims will replace all prior versions, and listings, of claims in the 
application: 

Listing of Claims: 

1 . (Currently Amended) A method comprising: 

receiving data from a network application program interface (API) of a 
sending client the data comprising a portion of an event to be sent from the sending client ; 

determining if the data is eligible for a security operation, wherein eligibility is 
determined by selector data contained in the data; 

creating a selector based on the selector data , wh e r e in sa i d s ele ctor 
indicat e s at le ast a port i on of th e data and a s e cur i ty assoc i ation and using said selector to 
search a database of security associations for at least one selector/security association pair 
identifying a security association corresponding to the selector said database storing a 
plurality of selector/security association pairs corresponding to different timewise intervals of 
said event : 

applying the security operation to the data if the data is eligible, wherein 
applying the security operation comprises using the security association on the at least a 
portion of the data; and 

sending the data to which the security operation has been applied to a 
network protocol layer of the sending client . 

2. (Currently Amended) The method of claim 1 , said event to be sent from the 
sending client to a receiving client said database being local at said sending client, the 
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receiving client storing a remote database comprising a similar plurality of selector/security 
association pairs respectively corresponding to said different timevyise intervals of said event 
furth e r compr i s i ng: 

using sa i d so le ctor to s e arch a databas e of socurity assoc i at i ons for at le ast on e 
s ele ctor/s e cur i ty assoc i at i on pa i r i d e nt i fy i ng a s e cur i ty assoc i at i on corr e sponding to th e 
s ele ctor . 

3. (Previously Presented) The method of claim 2 wherein the selector data is 
based at least in part on one of an internet protocol address taken from the data and a port 
indicator taken from the data. 

4. (Previously Presented) The method of claim 1 wherein applying the security 
operation comprises at least one of: 

attaching a header to the data, said header including a security operation tag; and 
encrypting the data. 

5. (Currently Amended) The method of claim [[1]] 2 wh e r ei n d e t e rmin i ng i f th e 
data i s eli g i bl e for th e s e cur i ty op e ration and app l y i ng th e s e cur i ty op e ration if th e data i s 
eli g i b le d e p e nds, at le ast i n part upon a l oca l s ele ctor/s e curity assoc i at i on pa i r at a s e nd i ng 
cli e nt corr e sponding to a r e mot e s ele ctor/secur i ty assoc i at i on pa i r at a r e c ei v i ng cl ie nt , said 
local database selector/security association [[pair]] pairs and said remote database 
selector/security association [[pair]] pairs having been received from a key server. 

6. (Currently Amended) A method comprising: 

receiving data from a network protocol laye r of a receiving client, the data 
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comprising a portion of an event being received at the receiving client : 

detemnining if the data is eligible for a security operation, wherein eligibility is 
deternnined by selector data contained in the data; 

creating a selector based on the selector data , said s ele ctor i ndicat i ng at 
le ast a portion of th e data and a s e curity assoc i at i on and using said selector to search a 
receiving client database of security associations for at least one selector/security 
association pair identifying a security association corresponding to the selector said 
receiving client database storing a plurality of selector/security association pairs 
corresponding to different timewise intervals of said event ; 

applying the security operation to the data if the data is eligible wherein 
applying the security operation comprises using the security association on the at least a 
portion of the data; and 

sending the data to which the security operation has been applied to a 
network application program interface (API) of the receiving client . 

7. (Original) The method of claim 6 wherein determining If the data is eligible for a 
security operation comprises at least one of: 

detecting a security operation tag in a header of the data; and 
detecting failure of an integrity check on the data. 

8. (Currently Amended) The method of claim 6 , said event being sent from a 
sending client to the receiving client, the sending client storing a sending client database 
comprising a similar plurality of selector/security association pairs respectively 
corresponding to said different timewise intervals of said event furth e r compr i s i ng: 

using said so le ctor to s e arch a database of s e cur i ty assoc i at i ons for at le ast on e 
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s ele otor/s e our i ty assoc i at i on pa i r i d e ntify i ng a s e cur i ty assoc i at i on corr e spond i ng to th e 
seleGter. 

9. (Currently Amended) The method of claim 8, said receiving client database 
selector/security association pairs and said sending client database selector/security 
association pairs having been received from a key serve r furth e r comor i s i na: 

b l ock i ng th e data from b ei ng sont to th e n e twork AP I i f no s e curity associat i on 

corr e spond i ng to th e s el ector i s found . 

10. (Currently Amended) The method of claim 6 wherein determining if the data 
is eligible for the security operation comprises [[:]] determining that the data is not eligible for 
the security operation if [[a]] the selector that r e f e r e nc e s a databas e of socur i ty assoc i at i ons 
cannot be created based on the selector data , and wherein said data is sent to the network 
API of the receiving client without an applied security operation if it is so determined that the 
data is not eligible . 

11. (Canceled) 

12. (Canceled) 

13. (Previously Presented) The method of claim 6 wherein the security association 
comprises at least one of: 

applying encryption to the data; 
removing special packaging from the data; 
applying decryption to the data; and 
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perfornning an integrity check on tlie data. 

14. (Currently Amended) A machine readable storage medium having stored 
thereon machine executable instructions, execution of said machine executable instructions 
being operable to implement a method comprising: 

receiving data from a network application program interface (API) ) of a 
sending client the data comprising a portion of an event to be sent from the sending client : 

determining if the data is eligible for a security operation, wherein eligibility is 
determined by selector data contained in the data; 

creating a selector based on the selector data , wh e r ei n sa i d s ele ctor 
i nd i cat e s at l e ast a port i on of th e data and a s e cur i ty assoc i ation and using said selector to 
search a local sending client database of securitv associations for at least one 
selector/security association pair identifying a security association corresponding to the 
selector said sending client database storing a plurality of selector/security association pairs 
corresponding to a succession of timewise intervals of said event : 

applying the security operation to the data if the data is eligible, wherein 
applying the security operation comprises using the security association on the at least a 
portion of the data; and 

sending data to which the security operation has been applied to a network 
protocol laye r of the sending client 

15. (Currently Amended) The machine readable storage medium of claim 14^ 
said event to be sent from the sending client to a receiving client having a remote database 
comprising a similar plurality of selector/security association pairs respectively 
corresponding to said succession of timewise intervals of said event furth e r compris i ng: 
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us i ng sa i d s ele ctor to s e arch a databas e of secur i ty assoc i at i ons, for at le ast ono 
s ele ctor/s e curity assoc i at i on pair id e nt i fying a correspond i ng a s e curity assoc i at i on . 

16. (Previously Presented) The nnachine readable storage medium of claim 14 
wherein the selector data is based at least in part on one of an internet protocol address 
taken from the data and a port indicator taken from the data. 

17. (Previously Presented) The machine readable storage medium of claim 14 
wherein applying the security operation comprises at least one of: 

attaching a header to the data, said header including a security operation tag; 
performing an integrity check; and 
encrypting the data. 

18. (Currently Amended) The machine readable storage medium of claim 14 
wh e r e in d e t e rm i n i ng i f th e data i s e l i gibl e for the secur i ty op e rat i on and app l ying th e s e cur i ty 
op e rat i on i f th e data is el ig i b le d e p e nds upon a local s ele ctor/s e cur i ty assoc i at i on pa i r at a 
s e nding c lie nt corr e spond i ng to a r e mot e s ele ctor/s e cur i ty assoc i at i on pair at a r e c ei ving 
c lie nt , said tecal sending client database selector/security association [[pair]] pairs and said 
remote database selector/security association [[pair]] pairs having been received from a key 
server. 

19. (Currently Amended) A machine readable storage medium having stored 
thereon machine executable instructions, execution of said machine executable instructions 
being operable to implement a method comprising: 

receiving data from a network protocol layer of a receiving client, the data 
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comprising a portion of an event being received at the receiving client : 

determining if the data is eligible for a security operation, wherein eligibility is 
determined by selector data contained in the data; 

creating a selector based on the selector data , sa i d s ele ctor i ndicat i ng at 
le ast a port i on of th e data and a s e cur i ty assoc i at i on and using said selector to search a 
local receiving client database of security associations for at least one selector/security 
association pair identifying a security association corresponding to the selector, said 
receiving client database storing a plurality of selector/security association pairs 
corresponding to a succession of timewise intervals of said event : 

applying the security operation to the data if the data is eligible, wherein 
applying the security operation comprises using a security association on the at least a 
portion of the data; and 

sending the data to which the security operation has been applied to a 
network application program interface (API) of the receiving client . 

20. (Previously Presented) The machine readable storage medium of claim 19 
wherein determining if the data is eligible for a security operation comprises at least one of: 

detecting a security operation tag in a header of the data; and 
detecting failure of an integrity check on the data. 

21 . (Currently Amended) The machine readable storage medium of claim 19^ 
said event being sent from a sending client to the receiving client, the sending client storing 
a sending client database comprising a similar plurality of selector/security association pairs 
respectively corresponding to said succession of timewise intervals of said event- fofthef 
having stor e d th e r e on machin e e x e cutab le i nstruction, oxocut i on of sa i d mach i ne 
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e x e cutab le instruct i on bo i ng operab le to impl e m e nt a m e thod further compr i s i ng: 

us i ng sa i d se le ctor te s e arch a databas e of s e cur i ty associat i ons for at le ast on e 
s ele ctor/s e cur i ty assoc i at i on pair i d e nt i fy i ng a s e curity associat i on corr e spond i ng to th e 
s ele ctor . 

22. (Currently Amended) The machine readable storage medium of claim 21^ 
said receiving client database selector/security association pairs and said sending client 
database selector/security association pairs having been received from a key server fafthef 
compris i ng: — 

b l ock i ng th e data from b ei ng s e nt to th e n e twork AP I i f no s e cur i ty assoc i at i on 
corr e sponding to the s e l e ctor i s found . 

23. (Currently Amended) The machine readable storage medium of claim 19 
wherein determining if the data is eligible for the security operation comprises [[:]] 
determining that the data is not eligible for the security operation if a selector that r e f e r e nc e s 
a databas e of s e cur i ty assoc i ations cannot be created based on the data , and wherein said 
data is sent to the network API of the receiving client without an applied security operation if 
it is so determined that the data is not eligible . 

24. (Canceled) 

25. (Canceled) 

26. (Previously Presented) The machine readable storage medium of claim 19 
wherein the security association comprises at least one of : 
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28. (Currently Annended) A management server apparatus at a receiving client 
receiving an event transmitted from a sending client, the event having a duration and being 
divided into a succession of timewise intervals that are relatively short compared to said 
event duration, comprising: 



receive a plurality of selector/security association pairs from a key server 
corresponding to said succession of timewise intervals of said event: 

receive data from a network protocol laye r of the receiving client, the data including a 
portion of the event within one of said timewise intervals . 

determine if the data is eligible for a security operation, wherein eligibility is 
determined by selector data contained in the data, 

create a selector based on the selector data, said selector indicating at least a 
portion of the data and a security association associated with at least one of said 
selector/security association pairs received from the key server : 

apply the security operation to the data if the data is eligible, wherein applying the 
security operation comprises using the security association on the at least a portion of the 
data, and 

send the data to which the security operation has been applied to a network 
application program interface (API) of the receiving client . 



a processing unit to: 
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